In a Denial-of-Service (DoS) attack, an attacker bombards a victim network or server with a large volume of message traffic, consuming the victim's available bandwidth, CPU capacity, or other critical system resources, and eventually bringing the victim to a situation in which it is unable to serve its legitimate clients. Distributed DoS (DDoS) attacks can be even more damaging, as they involve creating artificial network traffic from multiple sources simultaneously. In a “conventional” massive-bandwidth attack, the source of the attack may be traced with the help of statistical analysis of the source Internet Protocol (IP) addresses of incoming packets. The victim can subsequently filter out any traffic originating from the suspect IP addresses, and can use the evidence to take legal action against the attacker.
Many attacks, however, now use “spoofed” IP packets—packets containing a bogus IP source address—making it more difficult for the victim network to defend itself against attack. Various methods have been proposed for detecting DDoS attacks using spoofed packets. For example, Poletto describes a number of uses of traffic statistics in detecting DDOS attacks in “Practical Approaches to Dealing with DDOS Attacks,” presented at North America Network Operators' Group (NANOG22, Scottsdale, Ariz., May, 2001). Random distribution of IP source addresses is one sign of spoofing. Another possible sign of spoofing is randomization of the Time-To-Live (TTL) field in the IP packet header, which is supposed to indicate the number of hops that a packet has traversed through the network since leaving its source. Sudden changes in the statistical distribution of TTL values can also be detected. Although these statistical measures may enable a computer to recognize when an attack is occurring, however, they do not provide the means to distinguish between spoofed and legitimate packets during the attack.